What is the CVSS score of CVE-2024-14021?

CVE-2024-14021 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of AI / ML are affected by CVE-2024-14021?

CVE-2024-14021 presents notable security risk, a insecure deserialization vulnerability rated CVSS 7.8.. A patch is available.

Is there a public PoC exploit available for CVE-2024-14021?

Yes, a public proof-of-concept exploit is available for CVE-2024-14021. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-14021?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

AI / ML CVE-2024-14021

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-01-12 disclosure@vulncheck.com

Deserialization AI / ML Llamaindex

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 15, 2026 - 22:39 vuln.today

Public exploit code

CVE Published

Jan 12, 2026 - 23:15 nvd

HIGH 7.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on llama-index (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.11.7.

DescriptionNVD

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

AnalysisAI

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects Llamaindex. LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

RemediationAI

Monitor vendor advisories for a patch.

CVE-2024-14021 vulnerability details – vuln.today

Back

AI / ML CVE-2024-14021

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code